Extracted

Extracted

• • Target

    b2f3c1a6a5e577bf8713c5a728c1236457b1f4a3389b267425db9725329236e6

  • Size

    1.1MB

  • MD5

    991812a8daee1e9f28e89c53a6c0fa6e

  • SHA1

    b0f9c23898dbc5ab813c4c49c60d3e7b7311885a

  • SHA256

    b2f3c1a6a5e577bf8713c5a728c1236457b1f4a3389b267425db9725329236e6

  • SHA512

    d833894c18edbc92b8eb82d08e7f7d0017025eac3f2ad22504df07bf4a6986b1a45901a4b16e0620fa9d68db199d09ef1d602415cd197769eb99a3e51c4eabff

  • SSDEEP

    24576:qyHo0efB56OFZp6+REgwyKiAufKbKMVgICm973:xH/eJ56MS+uPufMVf9

  Score

  10^/10

  amadeyredlinedizaladadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1